High severity · published Apr 14, 2022
CVE-2022-24846
GeoWebCache is a tile caching server implemented in Java
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. While in GeoWebCache the JNDI strings are provided via local configuration file, in GeoServer a user interface is provided to perform the same, that can be accessed remotely, and requires admin-level login to be used. These lookup are unrestricted in scope and can lead to code execution. The lookups are going to be restricted in GeoWebCache 1.21.0, 1.20.2, 1.19.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geowebcache · Geoserver
before 1.19.3; 1.20.0 before 1.20.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24846
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24846
Third Party Advisory
https://github.com/GeoWebCache/geowebcache/security/advisories/GHSA-4v22-v8jp-438r
More from Geowebcache
8.8
CVE-2023-5786
A vulnerability was found in GeoServer GeoWebCache up to 1.15.1